HashiCorp Vault

HashiCorp Vault is a secrets management and data protection platform that securely stores, controls access to, and dynamically generates tokens, passwords, API keys, TLS certificates, and encryption keys through a unified CLI, HTTP API, and web UI. As the most widely adopted open-source secrets management tool in the CNCF ecosystem, Vault provides multiple secrets engines for specialized use cases. The KV Secrets Engine stores static key-value secrets with versioning and metadata. The Database Secrets Engine dynamically generates short-lived database credentials on demand, eliminating static password rotation. The Transit Secrets Engine provides encryption as a service for cryptographic operations without exposing raw keys to applications. The Transform Secrets Engine delivers enterprise-grade tokenization and format-preserving encryption for PCI-DSS and data residency compliance. The PKI Secrets Engine generates and rotates X.509 certificates automatically. Authentication methods include AppRole, Kubernetes, AWS IAM, Azure, Google Cloud, LDAP, OIDC, and JWT, enabling machine identity-based access. Policies enforce fine-grained read, write, list, and delete permissions per path with mandatory response wrapping. The Shamir secret sharing algorithm protects the master key across unsealed nodes. HCP Vault Dedicated provides a fully managed cloud service with automatic scaling, backups, and replication across performance and disaster recovery clusters. The Vault Associate certification validates practitioner expertise. The open-source edition is MPL-2.0 licensed.